25 questions · Connectivity And Security · All types, answers revealed
Which log type should be filtered if you are searching for specific firewall configuration changes made by an administrator?
Config logs are the audit trail for administrative changes.
Why this answer
Configuration logs (Config logs) explicitly track changes made to the firewall settings, including who made the change and when.
Which TWO of the following steps are required to implement a successful Site-to-Site VPN with a third-party vendor?
Interfaces must belong to a zone to be used in security policies.
Why this answer
Both IKE Phase 1 and Phase 2 crypto profiles must be configured correctly, and the tunnel interface must be assigned to a zone.
Which THREE components are involved in configuring an IKE Gateway for a VPN?
The interface is the physical point of exit.
Why this answer
An IKE Gateway requires the interface used for the connection, the peer IP, and a Pre-Shared Key or certificate for authentication.
When using OSPF with a Palo Alto Networks firewall, which area type would you configure to ensure the firewall does not receive external routing information while still maintaining connectivity to the backbone?
Totally Stubby areas minimize the routing table size by injecting only a default route.
Why this answer
A Totally Stubby Area allows the firewall to reach the backbone via a default route while filtering out external and inter-area routes to save resources.
Which THREE criteria can be used to define a security policy for granular control?
App-ID allows filtering by specific application signatures.
Why this answer
Security policies can use source/destination zones, specific user identity, and application identification.
An administrator observes that traffic is being correctly identified by App-ID, but the firewall is not applying the expected security profile. What is the most likely reason?
Without a profile group, the firewall will permit traffic without applying advanced security features.
Why this answer
Security profiles are only applied to traffic that is allowed by a Security Policy. If the policy does not have a profile group attached, the action is simply 'allow' without inspection.
Which TWO settings are configured within a GlobalProtect Gateway to manage user access?
Authentication profiles manage user credentials.
Why this answer
Gateway settings define the authentication profile and the specific tunnel settings for the client.
Which THREE tasks are performed by the Dataplane during traffic processing?
Session lookup is critical for fast-path traffic.
Why this answer
The dataplane is responsible for session lookup, security policy enforcement, and packet forwarding.
When troubleshooting a site-to-site VPN that is stuck in 'INIT' status, what is the most likely cause?
If the peer doesn't respond to IKE negotiation, the state remains INIT.
Why this answer
An 'INIT' status typically indicates that the firewall is waiting for an IKE response. This is usually caused by network reachability issues or incorrect peer settings.
When troubleshooting a BGP peering issue between a Palo Alto Networks firewall and an ISP, which log should be reviewed to see state changes and neighbor messages?
BGP status changes are logged under the System category.
Why this answer
System logs record infrastructure-level events, including BGP state changes and neighbor relationship transitions.
A user is unable to access an application via GlobalProtect. The logs show the user is authenticated, but the session is reset. What should the administrator check first?
Security policies are the most common reason for post-VPN traffic drops.
Why this answer
If authentication passes but the session is reset, it is often due to a security policy dropping the traffic post-VPN or an MTU issue causing fragmentation and connection resets.
Which CLI command is most effective for verifying if a specific packet is being blocked by a security policy in real-time?
This command correctly simulates traffic flow against the policy database.
Why this answer
The 'test security-policy-match' command allows the administrator to simulate a packet flow against existing security policies to see which one matches or if it is dropped.
You are troubleshooting a scenario where internal users cannot access an external server. The traffic log shows the traffic is 'allowed', but the byte count is 0. What is the most likely cause?
If the return path has a smaller MTU, packets will be dropped, resulting in no data transfer.
Why this answer
A byte count of zero in the traffic log usually indicates that a session was established but no data was successfully exchanged, often due to an MTU issue or a downstream device blocking the return traffic.
Which feature would you use to verify that a specific interface is properly connected to the upstream ISP?
This allows the firewall to respond to or initiate pings for connectivity testing.
Why this answer
Link Monitoring or Interface Management profiles (specifically enabling ping) are used to verify connectivity to the ISP gateway.
Which object type allows you to group multiple IP addresses into a single entity for use in security policies?
Address groups are specifically designed for this purpose.
Why this answer
An Address Group object allows you to aggregate individual address objects for simplified policy management.
What is the result of having two security policies with the same source, destination, and service, but different applications?
Policies are evaluated top-down; the first match wins.
Why this answer
Palo Alto Networks firewalls evaluate security policies from top to bottom. The first policy that matches the traffic criteria (including App-ID) will be applied.
An administrator notices intermittent packet loss in a GlobalProtect deployment where users connect via IPv6. Which configuration change is likely to resolve the issue if MTU fragmentation is suspected?
Reducing MTU accounts for VPN overhead, preventing fragmentation.
Why this answer
Adjusting the MSS (Maximum Segment Size) or MTU on the tunnel interface helps avoid fragmentation issues caused by VPN headers, which are a common cause of packet loss in tunnels.
An administrator wants to use DHCP to assign IP addresses to GlobalProtect clients. Where is this setting configured?
This is the correct navigation path to define client IP assignment.
Why this answer
In the GlobalProtect Gateway configuration, under the Client Settings, the IP pool or the use of an external DHCP server can be defined.
An administrator is implementing PBF (Policy Based Forwarding). What is a requirement for PBF to function correctly?
PBF acts as a policy-based override and requires specific egress parameters.
Why this answer
PBF requires a defined source zone, and the rule must be matched before the routing table determines the exit interface, otherwise the standard routing table takes precedence.
Which THREE items must be verified when troubleshooting traffic that is not being correctly identified as the intended application?
Overrides force the identification if the engine cannot determine the app.
Why this answer
Correct App-ID matching depends on having correct port mappings, proper decryption, and the use of the most specific policy.
Which type of VPN tunnel configuration is required for a Palo Alto Networks firewall to act as a client connecting to a third-party VPN gateway?
Route-based VPNs use tunnel interfaces, making them the standard choice for PAN-OS.
Why this answer
A Route-based VPN is the standard for Palo Alto Networks, as it creates a virtual tunnel interface, which is required for routing traffic through the VPN.
An administrator needs to restrict access to a specific internal server to only one remote VPN user. What is the most secure method?
This leverages user identity and object-based filtering for precise access control.
Why this answer
Using a combination of a dedicated security policy with a specific User-ID/Group-ID source and a specific destination address object is the standard practice for least privilege access.
Which TWO logs are essential when troubleshooting a user who cannot connect to the internet?
System logs show interface or route events.
Why this answer
Traffic logs verify if the traffic is being hit by a policy, and System logs can indicate if the interface itself is down or flapping.
Which TWO methods can be used to ensure the firewall has the latest threat intelligence for blocking malicious traffic?
Dynamic updates download the latest threat signatures.
Why this answer
Dynamic updates and external dynamic lists (EDLs) are the two primary ways to keep security intelligence current.
An administrator is configuring a Site-to-Site VPN and needs to ensure that the tunnel interface is included in the routing table. What must be done to ensure traffic can be routed across the tunnel?
A route is required to direct traffic towards the tunnel interface.
Why this answer
To route traffic into a VPN tunnel, the tunnel interface must be associated with a Virtual Router and have a static or dynamic route pointing to the remote subnet with the tunnel interface as the next hop.
Ready to test yourself?
Try a timed practice session using only Connectivity And Security questions.